From 848ce65d1339481f46576b725f0a80fe45e9cbaf Mon Sep 17 00:00:00 2001
From: 3030332422 <3030332422@qq.com>
Date: Mon, 29 Sep 2025 17:57:53 +0800
Subject: [PATCH] =?UTF-8?q?update:web=E7=AB=AF=E9=87=8D=E7=BD=AE=E5=AF=86?=
 =?UTF-8?q?=E7=A0=81=E9=A1=B5=E9=9D=A2=E5=8A=A0=E5=AF=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../security/controller/LoginController.java  | 32 +++++++++++++++++++
 .../modules/sys/dto/RetrievePasswordDTO.java  |  4 +++
 main/manager-web/src/apis/module/user.js      |  3 +-
 .../src/views/retrievePassword.vue            | 22 ++++++++++---
 4 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java b/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java
index 0108a548..50569546 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java
@@ -257,6 +257,38 @@ public class LoginController {
             throw new RenException(ErrorCode.SMS_CODE_ERROR);
         }
 
+        String password = dto.getPassword();
+        
+        // 获取SM2私钥
+        String privateKeyStr = sysParamsService.getValue(Constant.SM2_PRIVATE_KEY, true);
+        if (StringUtils.isBlank(privateKeyStr)) {
+            throw new RenException(ErrorCode.SM2_KEY_NOT_CONFIGURED);
+        }
+        
+        String decryptedContent;
+        try {
+            // 使用SM2私钥解密密码
+            decryptedContent = SM2Utils.decrypt(privateKeyStr, password);
+        } catch (Exception e) {
+            throw new RenException(ErrorCode.SM2_DECRYPT_ERROR);
+        }
+        
+        // 分离验证码和密码：前5位是验证码，后面是密码
+        if (decryptedContent.length() > 5) {
+            String embeddedCaptcha = decryptedContent.substring(0, 5);
+            String actualPassword = decryptedContent.substring(5);
+            
+            // 验证嵌入的验证码是否正确
+            boolean embeddedCaptchaValid = captchaService.validate(dto.getCaptchaId(), embeddedCaptcha, true);
+            if (!embeddedCaptchaValid) {
+                throw new RenException(ErrorCode.SMS_CAPTCHA_ERROR);
+            }
+            
+            dto.setPassword(actualPassword);
+        } else {
+            throw new RenException(ErrorCode.SM2_DECRYPT_ERROR);
+        }
+
         sysUserService.changePasswordDirectly(userDTO.getId(), dto.getPassword());
         return new Result<>();
     }
diff --git a/main/manager-api/src/main/java/xiaozhi/modules/sys/dto/RetrievePasswordDTO.java b/main/manager-api/src/main/java/xiaozhi/modules/sys/dto/RetrievePasswordDTO.java
index efac8099..5475cf67 100644
--- a/main/manager-api/src/main/java/xiaozhi/modules/sys/dto/RetrievePasswordDTO.java
+++ b/main/manager-api/src/main/java/xiaozhi/modules/sys/dto/RetrievePasswordDTO.java
@@ -25,6 +25,10 @@ public class RetrievePasswordDTO implements Serializable {
     @NotBlank(message = "{sysuser.password.require}")
     private String password;
 
+    @Schema(description = "图形验证码ID")
+    @NotBlank(message = "{sysuser.uuid.require}")
+    private String captchaId;
+
 
 
 }
\ No newline at end of file
diff --git a/main/manager-web/src/apis/module/user.js b/main/manager-web/src/apis/module/user.js
index c7290016..39f07077 100755
--- a/main/manager-web/src/apis/module/user.js
+++ b/main/manager-web/src/apis/module/user.js
@@ -183,7 +183,8 @@ export default {
             .data({
                 phone: passwordData.phone,
                 code: passwordData.code,
-                password: passwordData.password
+                password: passwordData.password,
+                captchaId: passwordData.captchaId
             })
             .success((res) => {
                 RequestService.clearRequestTime();
diff --git a/main/manager-web/src/views/retrievePassword.vue b/main/manager-web/src/views/retrievePassword.vue
index 03e5b0ac..62a1118e 100644
--- a/main/manager-web/src/views/retrievePassword.vue
+++ b/main/manager-web/src/views/retrievePassword.vue
@@ -101,7 +101,7 @@
 <script>
 import Api from '@/apis/api';
 import VersionFooter from '@/components/VersionFooter.vue';
-import { getUUID, goToPage, showDanger, showSuccess, validateMobile } from '@/utils';
+import { getUUID, goToPage, showDanger, showSuccess, validateMobile, sm2Encrypt } from '@/utils';
 import { mapState } from 'vuex';
 
 // 导入语言切换功能
@@ -115,7 +115,8 @@ export default {
   computed: {
     ...mapState({
       allowUserRegister: state => state.pubConfig.allowUserRegister,
-      mobileAreaList: state => state.pubConfig.mobileAreaList
+      mobileAreaList: state => state.pubConfig.mobileAreaList,
+      sm2PublicKey: state => state.pubConfig.sm2PublicKey
     }),
     canSendMobileCaptcha() {
       return this.countdown === 0 && validateMobile(this.form.mobile, this.form.areaCode);
@@ -229,10 +230,23 @@ export default {
         return;
       }
 
+      // 加密密码
+      let encryptedPassword;
+      try {
+        // 拼接图形验证码和新密码进行加密
+        const captchaAndPassword = this.form.captcha + this.form.newPassword;
+        encryptedPassword = sm2Encrypt(this.sm2PublicKey, captchaAndPassword);
+      } catch (error) {
+        console.error("密码加密失败:", error);
+        showDanger(this.$t('sm2.encryptionFailed'));
+        return;
+      }
+
       Api.user.retrievePassword({
         phone: this.form.areaCode + this.form.mobile,
-        password: this.form.newPassword,
-        code: this.form.mobileCaptcha
+        password: encryptedPassword,
+        code: this.form.mobileCaptcha,
+        captchaId: this.form.captchaId
       }, (res) => {
         showSuccess(this.$t('retrievePassword.passwordUpdateSuccess'));
         goToPage('/login');